CVSS: 9.8EPSS: 10%CPEs: 1EXPL: 0CVE-2022-21647 – Deserialization of Untrusted Data in Codeigniter4
https://notcve.org/view.php?id=CVE-2022-21647
04 Jan 2022 — CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. • https://github.com/codeigniter4/CodeIgniter4/commit/ce95ed5765256e2f09f3513e7d42790e0d6948f5 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10793
https://notcve.org/view.php?id=CVE-2020-10793
23 Mar 2020 — CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management faci... • https://codeigniter4.github.io/userguide/extending/authentication.html • CWE-269: Improper Privilege Management •